Senior Cyber SOC Incident Detector / Responder

HOW A CYBER INCIDENT RESPONDER WILL MAKE AN IMPACT

• We’re seeking an experienced and vigilant cybersecurity specialist who can proactively prevent breaches of all sizes, understand when they occur, and take immediate steps to remediate them.

• The ideal candidate understands cybersecurity standards and certifications, extensive knowledge of how cybercriminals work, and determination to never allow them access.

• Identify potential cyber threats, determine levels of risk, and produce analytical reports for a variety of audiences. You will occasionally be required to present your findings in front of senior executives, so the ability to translate technical indicators into layperson’s terms is vital.

• When serious threats are identified, you will work closely with other areas of the security team to identify appropriate solutions.

• You must be passionate about technology, and able to learn the ropes of new security solutions rapidly.

• Forensic analysis of digital information, Open-Source Intel (OSINT) review/monitoring, available tools both customer provided and open source, and pivoting/researching on previously reported Indicators of Compromise (IOCs).

• Participate in collaborative sessions with other CNDSPs and IC agencies on malicious intrusions, attacks or suspicious activities, as well as share emerging Cyber Threat Intel data. 

• Assist in the development of IOCs for active defensive countermeasures and passive detection signatures.

WHAT YOU’LL NEED TO SUCCEED:

• Bachelor's Degree and 8+ years of relevant experience,equivalent combinations of education, certifications, and experience will be considered. 

• DoD Approved Baseline 8570/8140 IAT Level II (Sec+, CySA+, CND, CCNA-Security) certification required prior to start date.

• DoD Approved Baseline 8570/8140 CSSP Incident Responder (CEH, CFR, CHFI, Cloud+) certification required prior to start date.

• GIAC Continuous Monitoring (GMON) or equivalent (other GIAC certs, CSA, ECIH, any cert under 8570/8140 CSSP Incident detector) certification required within first 120 days of employment 

• Splunk Core User certification required within first 120 days of employment 

• Security Clearance Level: TS/SCI clearance and ability to obtain and maintain a Polygraph

REQUIRED SKILLS AND ABILITIES:

• Must have common knowledge of standard network infrastructure.

• Other items that would be good to know include: domain masquerading, certificates, and file hashing.

• Familiar with monitoring emerging threats through Tools, Techniques, and Procedures (TTPs) and how they relate to the MITRE ATT&CK Framework

• Good written communications skills are necessary to properly document and report the identification and sharing of newly identified IOCs.

• Meticulous eye for detail and an ability to multitask in a fast-paced environment.

• Maintain knowledge of current cybercrime tactics.

• Day, Swing, or Mid Shift position available: Willing to work a weekend or holiday shift supporting your assigned shift. 

• This position is for Day Shift.

Location: On Customer Site

• Bolling AFB, Washington D.C.